theonedev up to 15.0.6 Symbolic Links TarUtils.untar symlink

Summaryinfo

A vulnerability was found in theonedev onedev up to 15.0.6. It has been declared as critical. The impacted element is the function TarUtils.untar of the component Symbolic Links Handler. Executing a manipulation can lead to symlink. This vulnerability is registered as CVE-2026-49248. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in theonedev onedev up to 15.0.6 and classified as critical. This vulnerability affects the function TarUtils.untar of the component Symbolic Links Handler. The manipulation with an unknown input leads to a symlink vulnerability. The CWE definition for the vulnerability is CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. This is exploitable by any authenticated user with CI Job write access — no admin interaction required. This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets. This issue has been fixed in version 15.0.7.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49248 since 05/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Upgrading to version 15.0.7 eliminates this vulnerability. Applying the patch 4f8684acebc4bfeefd3c7e23a34a4fd591cb27ad is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• theonedev

Name

• onedev

Version

• 15.0.0
• 15.0.1
• 15.0.2
• 15.0.3
• 15.0.4
• 15.0.5
• 15.0.6

License

• open-source

Website

• Product: https://github.com/theonedev/onedev/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion